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A central problem in quantum computation is to understand which quantum circuits are 
useful for exponential speed-ups over classical computation. We address this question in 
the setting of query complexity and show that for almost any sufficiently long quantum 
circuit one can construct a black-box problem which is solved by the circuit with a constant 
number of quantum queries, but which requires exponentially many classical queries, even 
if the classical machine has the ability to postselect. 

We prove the result in two steps. In the first, we show that almost any element of an 
approximate unitary 3-design is useful to solve a certain black-box problem efficiently. The 
problem is based on a recent oracle construction of Aaronson and gives an exponential 
separation between quantum and classical bounded-error with postselection query com- 
plexities. 

In the second step, which may be of independent interest, we prove that linear-sized 
random quantum circuits give an approximate unitary 3-design. The key ingredient in the 
proof is a technique from quantum many-body theory to lower bound the spectral gap of 
local quantum Hamiltonians. 



I. INTRODUCTION 

Quantum computation holds the promise of solving certain problems substantially faster than 
classical computation. The most famous example is arguably Shor's polynomial-time quantum 
algorithm for factoring |0], a task which is believed to require exponential time in a classical 
computer. Other problems for which quantum algorithms appear to be give exponential speed- 
ups include simulating quantum systems 0], solving Pell's equation approximating the Jones 
polynomial H, @], and estimating certain properties of sparse systems of linear equations |@]. 
Unfortunately, the apparent computational superiority of quantum mechanics is presently only 
conjectural. In fact, one cannot hope to separate the class of problems solved in polynomial time 
by quantum and classical computation without settling major open questions in computational 
complexity theory 1 . 

A setting for which quantum computation is provably superior to classical is the one of query 
complexity (also known as decision tree complexity or black-box complexity). There one is given 
the ability to query a black-box function and the goal is to determine a certain property of the 
function. The complexity of the problem is measured by the minimum number of queries needed 
to determine such property. In the quantum case, one is able to query the black-box in superposi- 
tion, a feature which potentially renders it more powerful than the classical one. 
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1 such as P = PSPACE. 
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The first example of a black-box problem exhibiting a superpolynomial separation of quantum 
and randomized classical query complexities was the recursive fourier sampling (RFS) problem of 
Bernstein and Vazirani jg]. Soon after it, Simon presented a black-box problem with an exponential 
quantum-classical separation @J; Simon's problem is also a good example of the usefulness of the 
query complexity model for the development of new algorithms: its quantum solution was both 
a motivation for and an important element in Shor's quantum algorithm for factoring J3]. Many 
other oracle separations have since been found, see e.g. |lC-j3]. In terms of complexity classes, 



these query complexity results show the existence of an oracle U for which BQP 17 ^ BPP U . 2 

Having collected evidence that quantum computation is superior to randomized classical com- 
putation, it is interesting to get insight about where exactly does BQP sit in the zoo of classical 
complexity classes. For example, are there problems that a quantum computer can solve effi- 
ciently, but which a classical computer cannot even check a potential solution in reasonable time? 
This is the question whether BQP C NP and already in the seminal paper the RFS problem 
was used to build an oracle U such that BQP^ 7 ^ NP^. One can go even further and ask for an 
oracle for which BQP is not contained in the entire polynomial hierarchy (PH). In |0] it was con- 
jectured that the RFS problem also gives an oracle relative to which BQP ^ PH, but whether this 
is indeed the case remains an open question. 

Recently, Aaronson J3] proposed an interesting new oracle problem as a candidate to put BQP 
outside PH. 3 Although the usefulness of this oracle for the BQP vs. PH question still has to be 
elucidated, the problem was shown to have a huge separation of quantum and classical query 
complexities: it can be solved by a constant number of quantum queries, while it requires ex- 
ponentially many queries by a classical machine, even if we give the classical machine the - ex- 
tremely powerful - ability to postselect on a given result of the computation. This is the strongest 
separation of quantum and classical query complexities to date. It also implies oracles relative to 
which BQP £ BPP path 4 and BQP £ SZK, which supersedes all previous oracle separations for 
BQP. 

Aaronson's problem, named FOURIER CHECKING, is the following: We are given two boolean 
functions /, g : {0, l} n — > {—1, 1} with the promise that either 

• / and g are chosen uniformly at random, or 

• for a vector v £ IR 2 " with entries v x drawn independently from a normal distribution of 
mean and variance 1, the functions are chosen as f(x) = sgn(v x ) and g(x) = sgn(v x ) 5 . 
Here the vector v is the Fourier transform over of v and is given by 

*.= £ (-irv a) 

ye{o,i} n 

The task is to decide which is the case. In words, we should determine if the two functions are 
not correlated at all or if one of them is well correlated with the Fourier transform of the other. 



2 see the complexity zoo (http: / / qwiki.stanford.edu/wiki/ Complexity _Zoo) for definitions of the standard complex- 
ity classes. 

3 In jj] it was shown that the separation would follow from a certain generalization of the Linial-Nisan conjecture Il6ll 
recently settled by Braverman jl^l . However this generalization was later falsified in fl^l . 

4 Here BPP palh is defined as the class of problems which can be solved in polynomial time, with high probability by a 
randomized classical computer which can postselect on given outcomes of the computation fl^l . 

5 The sign function is defined as: sgn(x) = 1 for x > 0, and sgn(a;) = — 1 otherwise. 
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The quantum algorithm proposed in Jl|] to solve the problem is particularly simple. One pre- 
pares the uniform superposition over the computational basis, queries /, applies the quantum 
Fourier transform (QFT), queries g, and checks if the final state is again in a uniform superposition 
over the computational basis. If the functions are independent, then there is only an exponential 
small chance of getting the right outcome in the final measurement, while in the case where they 
are correlated, this happens with constant probability. 

Considering how well this problem fleshes out the superiority of quantum computation to 
classical, it is worthwhile to try to understand what exactly gives its strength. For instance, what 
is the role played by the Fourier transform, both the the definition of the problem and in the 
quantum algorithm solving it? Can we replace it by some other transformation? One of the goals 
of this paper is to shed light on these questions. 

From a broader perspective, we will be concerned with the following question, central to our 
understanding of the computational capabilities offered by quantum mechanics: What is the set of 
quantum circuits which provide large quantum speed-ups? More precisely, for which quantum 
circuits can we construct black-box problems which are solved by the circuit with only a few 
queries to the black-box, but which require a large number of queries for randomized classical 
computation? This question is in a sense a converse to the well-studied problem of characterizing 
the class of black-box functions allowing for significant quantum speed-ups (see e.g. 12(1 21])- 



While the latter deals with the determination of which computational problems are suited for 
quantum computing, the former contributes to the classification of which quantum algorithmic 
techniques are useful for solving problems efficiently. 

For instance, all the early examples of quantum algorithms offering superpolynomial speed- 



ups la, |9t |22j, |23J] were based on the quantum Fourier transform and this led to the speculation 
that it could be the defining aspect of quantum computation behind quantum speed-ups. Subse- 
quently, other black-box problems showing a quantum advantage were found having no relation 
to the QFT |@, 3, 24], hence extending the scope of techniques for constructing quantum algo- 
rithms. 



Of particular note in this context, and for this paper, is the work of Hallgren and Harrow [24J] on 
generalizations of Bernstein and Vazirani's RFS problem. The RFS classical-quantum separation 
is built in two steps: first one construct a black-box problem requiring a constant number of 
quantum queries, but U(n) classical queries. Then one uses recursion to boost the separation to a 
n O(i) quantum versus n log ( n ) classical queries. The oracle problem in the first part is based on the 



Fourier transform and solved by the QFT. In |24f | it was shown that this problem could be modified 
to have almost any quantum circuit (from a natural measure on circuits) in the place of the Fourier 
transform and still achieve the constant versus linear separation, as in the original formulation. 
Moreover, any such problem could also be boosted by recursion to provide a black-box problem 
with a superpolynomial quantum-to-classical gap in query complexity. 



A. Our results 



In this paper we generalize Aaroson's FOURIER CHECKING problem Jl]] and show that the 
Fourier transform, both in the definition of the problem and in the quantum algorithm solving 
it, can be replaced by a large class of quantum circuits. These include both the Fourier transform 
over any (possibly non-abelian) finite group and almost any sufficiently long quantum circuit from 
a natural distribution on the set of quantum circuits, which we discuss later on. We obtain expo- 
nential separations of quantum and postselected classical query complexities for all such circuits. 
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Flat circuits imply exponential separation: In more detail, we first introduce a simple measure of 
flatness, or dispersiveness, of a unitary U on n qubits, denoted C(U) . It is defined as the minimal 
min-entropy 6 (over j £ {0, .., 2™ — 1}) of the outcome probability distribution of a computational 
basis measurement applied to U\j). For N := 2 n , 

C(U) : = min h min ({\{0\U\j)\ 2 , \(N - l\U\j)\ 2 }) , (2) 

J 6 [AT] 

with [N] := {0, ...,N — 1}. It thus measures the worst-case dispersiveness of states obtained by 
applying U to computational basis states. 

In section III Al we define, for a unitary U, the black-box problem U-ClRCUlT Checking, a 
variant of FOURIER CHECKING in which the Fourier transform in the definition of the vector v 
(given by Eq. ((D) is replaced by U. The problem is constructed so that a quantum computer can 
easily solve it with access to a few realizations of the unitary U, while it is classically hard for any 
U with large C(U). 

In detail, on one hand we prove a lower bound of 2 n ( c ( !7 )) on the classical query complexity 
with postselection of U-ClRCUlT Checking (see section Hv|). Following the ideas of U, we do 
so by showing that the discretized version of the random vector (v, Uv) - for a vector v com- 
posed of independent elements v x each drawn from a normal distribution of mean and variance 
1 - is fc ( 1 )2 r2 ( c ( l/ ^-almost /c-wise independent (a fact which was shown to imply the previous 
exponential lower bound on the postselected classical query complexity Jl|]). 

On the other hand, on a quantum computer we can solve U-ClRCUIT CHECKING by the 
following simple modification of Aaaroson's algorithm: we prepare each qubit in the |+) := 
(|0) + |l))/v2 state, forming the uniform superposition over the computational basis. Then we 
query the / function, apply the circuit U, query the g function, and measure each qubit in the 
Hadamard basis, accepting if all of them are found in the |+) state. Therefore we obtain: 

Theorem I For any circuit U acting on n qubits with C(U) = $7(n), the problem U- 
Circuit Checking shows an exponential separation of quantum and postselected classical query com- 
plexities. 

We then proceed by giving two classes of unitaries with C(U) = Q(n). 
Theorem II 

(i) Let Uqft(G) be the quantum Fourier transform over the finite group G. Then C(Uqft(G)) > 
|log|G|. 

(ii) Given any 2~ Un -approximate unitary t-design on n qubits, all but a 2~( t ( 1 ~^) _2 ) n+1 fraction of 
its elements have C(U) > j3n. 

In particular, we find that for 2~ 9rt -approximate unitary 3-designs, all but a 2 -rt / 2+1 fraction of 
its element have C(U) > n/6. We note that the result of the theorem does not appear to hold true 
for unitary 2-designs and thus we seem to have the first application of unitary t-designs for t > 2. 

The proofs of both statements of Theorem [II] are elementary and are given in section HHl 

Random circuits are unitary 3-designs: A unitary t-design is an ensemble of unitaries {fi(dU), U }, 

for a measure p, on the set of unitaries, such that the average (over p) of any t-degree polynomial 



6 For a probability distribution p(x) we define its min-entropy as /imin(p) 



= - log maxs p(x) 
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on the entries of U and their complex conjugates is equal to the average over the Haar measure. 
An approximate unitary t-design is a relaxed version of the previous definition, in which we only 
require that the averages are close to each other (see section UTO for a precise definition) |2^, 26ll . 



In a series of papers 127H31Q it was established that polynomially long random quantum cir- 
cuits constitute an approximate unitary 2-design. The random quantum circuit model used is the 
following: in each step a random pair of qubits is chosen and a gate from a universal set of gates, 
also chosen at random, is applied to them. Although there is evidence that random quantum 



circuits of polynomial lenght are unitary t-design for every t = poly(n) 1321, 13311 , this has not been 
rigorously proved so far, even for the 3-design case. 

Here we prove that random quantum circuits are indeed approximate unitary 3-designs. We 
show it both for the random circuit model of the previous paragraph and for a different one, 
introduced in l33l as a toy model for the evolution of black holes, which is more suited for the 
methods we employ. In this model, which we call local random quantum circuit model, the qubits 
are arranged in a circle and in each step a random two-qubit gate is applied to two neighbouring 
qubits. 

Theorem III 5n log(l/e)-szze local random quantum circuits form an e-approximate unitary 3-design. 



The proof of Theorem [TTT] is based on a reduction, first put forward by Brown and Viola |3c 
connecting the convergence rate of moments of the random quantum circuit to the spectral gap 
(the difference of the lowest and second lowest eigenvalues) of a quantum local Hamiltonian. Our 
main contribution is to show in section [Vl] that we can obtain a lower bound on this spectral gap 
employing a technique from quantum many-body theory used e.g. in 13^-3^1. 



In particular, using this technique we are able to reduce the problem of bounding the spectral 
gap of the random walk on n qubits induced by the random circuit, to bounding the spectral gap 
of the same random walk, but now defined only on three neighbouring qubits. Then it suffices to 
bound the convergence time of the second and third moments of the latter random walk in order 
to prove that the random circuit constitute a 3-design. We believe our approach is promising 
also for higher values of t and might pave the way to a proof that random quantum circuits are 
approximate unitary t-designs for all t = poly(n). We however leave such possibility as an open 
problem for future work. 

Combining Theorems[TIl]and[lI]we obtain our main result that almost any polynomial quantum 
circuit is useful for exponential quantum speed-ups. 

Theorem IV For the distribution induced by the local random quantum circuit model, all but a 2~ n (") 
fraction of quantum circuits U with more than 0(n 2 ) gates are such that U-Circuit Checking shows 
an exponential gap in the quantum and the postselected classical query complexities. 



The role of C(U) and classical efficient solution for sparse unitaries: We have seen that dis- 
persive unitaries U with large C(U) give an exponential speed-up in U-ClRCUlT Checking. Is a 
large C(U) always required for a speed-up? We present two results indicating that this is indeed 
the case. 

First we show that with a modified notion of oracle access (we call it the independent query 
model), in which a different independent realization of the random parameters of the oracle is 
chosen in each query, a linear C(U) is necessary for an exponential speed-up. 

Theorem V In the independent query model of oracle access, the randomized classical query complexity 
o/U-Circuit Checking is equal to 2 e( - c( - u ^. 
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Second we consider the circuit checking problem for approximately-sparse U, defined as uni- 
taries which can be approximated (in operator norm) by a sparse matrix with only polynomially 
many non-zero entries in each row and column. Then we show the following. 

Theorem VI For approximately-sparse U the randomized classical query complexity of U- 
Circuit Checking is polynomial. 



We prove Theorem |VI] by showing how a recent result of Van den Nest [39fl on the classical 
simulability of certain quantum states and operations implies that the quantum algorithm for 
U-ClRCUIT CHECKING with a sparse U can be efficiently simulated with only polynomial many 
classical queries to / and g. 



B. Related Work 



This paper has a similar flavor to Hallgren and Harrow's work on the RFS problem [24]. The 



idea of considering the dispersiveness of quantum circuits as a resource for oracle speed-ups also 
first appeared in |24Q. where a different, but related, notion of dispersive circuits was proposed 
and a constant versus linear separation in query complexity was shown for all such dispersive 
circuits; in section III Bl we discuss it in more detail and show that our definition of a dispersive 
circuit is somewhat more demanding than theirs (although not completely comparable). In §2$ \ it 
was shown that both the Fourier transform over any finite group and almost any sufficiently long 
quantum circuit are dispersive. Implicit in their work is also the statement that most elements 
of an approximate unitary 2-design are dispersive. Although their definition of dispersiveness is 
weaker than ours and therefore broader, the separations we obtain are much stronger. While we 
get an exponential separation of quantum and postselected classical query complexities, they get 
a superpolynomial versus polynomial separation of quantum and classical query complexities, 
and only by using recursion (which itself can be seen as the responsible for the superpolynomial 
speed-up). 



There has been a series of work M25l, |26|, |3(X |4Q|, I42TI on unitary f-designs (and on the closely 



related quantum expanders |H-4§]) and on their connection to random quantum circuits 1 251-331]. 
An important problem in this area is to derive efficient constructions on a quantum computer 
of app roximate unitary t-designs. While there are several efficient constructions for 2-designs 
1 25, 4j, 3, 47], there is only a single one (based on the QFT) for unitary i-design on n qubits with 
t > 2 (going up to t = fi(n/log(n))) ||4lll . Our proof that random quantum circuits constitute a 
3-design gives an alternative efficient construction for the t = 3 case. 

Recently Brown and Viola proposed an interesting approach to the problem of random 
quantum circuits as unitary i-designs, based on mapping the convergence time of moments of 
the random circuit to the spectral gap of a mean-field quantum Hamiltonian. Conditioned on 
an unproven, but reasonable, conjecture about the low-lying eigenstates of the Hamiltonian, they 
showed that random quantum circuits of linear length are i-designs for every fixed t and suffi- 
ciently large n. Our approach also starts by a reduction of the problem to lower bounding the 
spectral gap of quantum Hamiltonians. However, in our case, we find a local quantum Hamilto- 
nian, consisting of nearest-neighbor terms only. We are also able to rigorously lower bound such 
spectral gap for t < 3, therefore obtaining a complete proof in this case. 

After the completion of our work, we learned about a recent paper by Fefferman and Umans 



1 490, in which the problem U-ClRCUIT CHECKING is also considered. Their focus is to study 



the usefulness of this problem in constructing an oracle separation of BQP and PH, by relating 
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such possibility to a conjecture [50] about the capacity of the Nisan-Wigderson pseudorandom 
generator | j5lf | to fool A Cq. To this aim only unitaries of a very special structure are consired in 
U-ClRCUIT CHECKING. Our approach has the advantage that we can show an exponential gap of 
quantum and postselected-classical query complexities for a generic polynomial quantum circuit 
(a task not considered in lli^l), but has the drawback that we fail to give evidence that there are 
circuits providing a separation of BQP to PH. 



II. PRELIMINARIES 



A. The oracle problem and its quantum solution 



Given a unitary U € U(iV) (with U(iV) the group of N x N unitary matrices) we consider the 
following extension of the FOURIER CHECKING problem (J]: 

U-ClRCUIT CHECKING: We are given access to two black-box functions 7 f,g : {0, l} n — > 
{1,-1} with the promise that either 

• (independent and random) / and g are chosen independently and uniformly at random, 
with each of their entries drawn from a random unbiased coin, or 

• ([/-correlated) for a vector v € with entries v x drawn independently from a normal 
distribution of mean and variance 1, the functions are chosen as f(x) = sgn(v x ) and 
g(x) = sgn(Re((Uv) x )) 8 . The vector Uv is given explicitely by 

(UV) X = U X yVy. (3) 

ye[N] 

The problem is to decide which is the case. 

Consider the following quantum algorithm for solving U-ClRCUIT CHECKING, where U acts 
on n qubits: 

Quantum Algorithm for U-ClRCUIT CHECKING: 

(i) Prepare each of the n qubits in the |+) state. 

(ii) Query the / oracle. 

(iii) Apply the unitary U. 

(iv) Query the g oracle. 

(v) Measure each qubit in the Hadamard basis {|+), |— )} and accept if all qubits are in the |+) state. 
Let 

I/)- E (-1) ,W I*> (4) 

xe{Q,i} n 



7 In this work we consider the phase-oracle model for quantum queries. Namely, let Uf be the oracle unitary of / and 
\x) a computational basis state. Then Uf\x) = (— l) f ^\x) (and likewise for g). 

8 here Re(z) is the real part of the complex number z. 
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and 

xe{o,i} n 

Then it follows that the acceptance probability of the algorithm is given by 

Pu(f,g)--=\(g\U\f)\ 2 . (6) 

The next proposition shows the quantum algorithm above can distinguish the cases of correlated 
(by the action of U) and independent / and g. 

Proposition II.l If f and g are drawn independently and uniformity at random, 

E( Pu (f,g)) = ^ (7) 

while if f and g are \J-correlated, 

E(M/,s))>0.07 (8) 

Proof In fjl] Aaronson proved the proposition for the case in which U is the quantum Fourier 
transform over Z^, which appeared as Theorem 9 in [1]. A closer inspection at his proof shows 
that the only property of the quantum Fourier used is the fact that it is a unitary. Therefore the 
reasoning of [1] can be applied here without any modification. We obmit reproducing the full 
argument and instead refer the reader to U. □ 



B. Dispersing Circuits 

We now define a notion of dispersive, or flat, circuits which will play a central role in this work. 
Let /i m in be the min-entropy defined as 

frminO) = -logmaxp(x). (9) 

X 

Definition II.2 For a unitary U we define: 

C(U) := mmh min {{\(0\U\j)\ 2 ,...,\(N-l\U\j)\ 2 }) (10) 

i,j€[N] 



log( maxjty^ ) . (11) 



It is interesting to compare this definition of a dispersive circuit with Harrow and Hallgren's 



L24]: 



Definition II.3 (HH-dispersiveness h24l ) A unitary U £ U(2 n ) is (a, f3)-dispersing if there exists a set 
A C {0, l} n with \A\ > 2 an and 



E \(a\U\x)\>^ (12) 

a;e{0,l}" 



for all a E A. 
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Thus while Def. III.2l looks at the infinity norm of the outcome probability distribution of mea- 
surements in the computational basis, maximized over all initial computational basis states, HH- 
dispersiveness (Def. III.3|) is concerned with the 1-norm of such probability distribution, and the 
maximum taken only over a constant-size fraction of all the computational basis states. 



In |24l1 it was shown that (a, ($)— dispersing circuits, for a,(3 = O(l), are useful for speed-ups 
in the variant of the RFS problem there defined. If we allow for lower values of /3 than a constant 
(but still requiring the circuit to be fairly flat), then a dispersive unitary according to Def. 111.21 is 
also HH-dispersive. Indeed, a simple calculation (which we omit here) shows that if U is such 
that C(U) > yn, then U is also (1, 2^~ 1 W 2 )-dispersive according to Def. HD1 



C. Approximate Unitary Designs 

We start defining a norm on quantum operations which we will use to compare two superoper- 
, i 
ators. ForX E B(C d ) we define the p-Schatten norms \\X\\ P := tr(\X\ p )p. Then for a superoperator 

A : B(C d ) -> B(C d ') we define the p — > q induced Schatten norm as 

||AWIU ? :=supM^. (13) 

Finally, the diamond norm is defined as the CB-completion of the 1 — > 1 norm, 

||A|| :=sup||I d ® A||i_,i. (14) 

d 

There are several different definitions of e-approximate unitary i-designs. A convenient one 
for us is the following. 

Definition II.4 (Approximate unitary t-design) Let {p, U} be an ensemble of unitary operators from 
U(d). Define 

QM = [ u^p^T^idu) (is) 

JV(d) 



and 



GhAp) = I U^pitfftpnidU), (16) 

JV{d) 

where pn is the Haar measure. Then the ensemble is a e-approximate unitary t-design if 

\\Q„,t-G H ,th^2<e. (17) 



The following Lemma from [52] shows that the previous notion of an approximate unitary 



design implies two others, which will also be relevant in this work. 

Lemma II.5 (Lemma 2.2.14 of [52]). Let {p, U} be an e-approximate unitary t-design on U(d) according 
to Def. EU Then 

(a) For Q^ t and Qn,t given by Def. \IIA\ 

\\G^t - GhA\« < d*e. (18) 

(b) For every balanced monomial M = U Piqi ...U Pkqk U* lSl ...U* kSk of degree k < t, 

\Eu^ (M(U)) - Eu^ H (M(U)) | < d 2t e. (19) 
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III. FAMILIES OF FLAT UNITARIES 



In this section we prove Theorem [TT] showing two examples of families of unitaries which are 
highly dispersing. 

Quantum Fourier Transforms: Let G be a finite group with irreducible unitary representations 
{V\} Ag g, where r\(g) is the unitary matrix representation of the group element g G G in the irrep 

V\ and G labels all inequivalent irreps of G. Let also {\g)} g ^G be an orthogonal basis for Cl G L The 
quantum Fourier transform over G is given by 



rj. ~ dim v x 

tWG) = W-^pEE E rx(gh\\^,j)(g\. (20) 

We now prove the first part of Theorem [TT] . 

Proof (Theorem [TT| part (i)) The statement is a simple application of the following basic relation, 
valid for any finite group l|53ll : 

^dim(y A ) 2 = |G|. (21) 

AeG 

Indeed, Eq. ((21]) implies dim V\ < \G\ 2 for every AeG and thus 

|(A,.,i|^QFT(G)b)| 2 = ^^|r A (^| 2 < \G\~K (22) 

which implies C(U QFT (G)) > □ 
Unitary 3-designs: 

Lemma III.l For every e-approximate t-design {p,(dll), U} on U(d), 



Pr (C{U) <u)< d 2 2 ut (d'Hl + d 2t e) . (23) 



Proof By Markov's inequality 

Pr (\(i\U\j)\ 2 > X) = Pr {\(i\U\j)\ 2t >A*) 

< ^Mmn _ (24) 

Since {fi(dU), U} is an e-approximate unitary t-design, Lemma ril.5l gives 

Eu^{mU\j)\ 2t ) <Eu^ H (mu\j)\ 2t )+d 2t e. (25) 

We have 

Eu^ H (mm 2 *) = Eu^ H ((mmtf\i)) 

= tr([ MdUp^m^iU^ (Mi])®* 



u 

d + t ~ A ~\r(P sym , t (mr) = ( d + t t ~y\ (26) 
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for P S ym,t the projector onto the ( d+t t *) -dimensional symmetric subspace of (C d )®*. 
Then, from Eqs. ((24)) , ((25)) , (|26)) and the union bound, 

Now we set A = 2~ u , use the bound 

d + t- 1\ _ (d + t- l)...(d + l)d ^ d* , OQ , 

- 7T' 



t / t! - t! ' 

and we are done. □ 

Proof (Theorem HT1 part (ii)) 

Let {fi(dll), U} be a 2 _3 '™-approximate unitary t-design on U(2 n ). Then applying Lemma Till. 11 
with v = (3n, Pr^ (C(U) < pn) < 2 2 ™2 /3n *2-* n+1 (l + t\). □ 



IV. CLASSICAL LOWER BOUNDS 



In this section we prove an exponential lower bound on the postselected classical query com- 
plexity of U-ClRCUlT Checking for dispersive circuits. Following (1], our strategy will be to 
show that the distribution in the U-ClRCUIT CHECKING problem in the case of U-correlated strings 
is approximately k-wise independent. Then the result follows from the following proposition 
from (J, relating this property to bounds on the postselected query complexity of distinguishing 
such distribution from the uniform one: 

Proposition IV.l (Lemma 20 o/jQ]) Suppose a probability distribution V over oracle strings is S-almost 
k-wise independent. Then no bounded-error postselected classical machine running in less than k steps can 
distinguish V from the uniform distribution with bias larger than 25. 

Proof (TheoremO) Propositions IIV.31 and II V. ll give a lower bound of 2 C ^/ 7 on the classical query 
complexity with postselection of U-ClRCUIT CHECKING. Together with the O(l) queries quantum 
algorithm for the problem from section Hi Al implies Theorem [0 □ 

For a string {x\, ...,xm} G {— 1, we call a term of the form a literal and define a k- 
term as a product of /c-literals, which equals 1 if all the literals are 1 and otherwise. Then an 
approximate fc-wise independent distribution is defined as follows. 

Definition IV.2 A distribution V over {—1, 1} M is e-almost k-wise independent if for every k-term C, 

^ < Pr(C) < i£. (29) 

In words, V is e-almost /c-wise independent if the probability of every k-term is e-multiplicatively 
close to its value on the uniform distribution (which is simply 2~ k ). 

Consider the vector u v% u G {— 1, 1} 2N given by 

lj v>u := (sgn(«i), ...,sgn(v N ),sgn(Re(Uv)i), ...,sgn(Re(Uv) N )) (30) 

and let T>u be the distribution over oj v jj when the vector v := (v\, vjy) is composed of inde- 
pendent entries v^, each drawn from a normal distribution of mean and variance 1. Then we 
have 
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Proposition IV.3 Vy is (6fc 3 2 c ( u ^ 2 )-almost k-wise independent. 
Proof Define 

Zj = N> < j < m (31) 

I (Uv) r (j) if m < j < k. 

for injective functions s : [m] — > [N] and r : [k — m] — > [N] . Consider the following probability 

P := Pr (sgn(Re(zi)) = a x , sgn(Re(z 2 )) = a 2 , sgn(Re(z fe )) = a k ) , (32) 

for a tuple a := (ai, a^) € { — 1, l} fc - In the remainder of the proof we show that the probability 
in Eq. (1321 is (6/c 3 2~ c ^/ 2 )-multiplicatively close to 2~ k for every choice of the tuple a, functions 
s, r, and integer m < k, which readily implies the statement of the proposition. 

First we note that the probability of Eq. ((32)) is equal to 

P = Pr (aiRe(zi) > 0, a 2 Re(z 1 ) > 0, ...,a k Re(z k ) > 0) (33) 

and that y := (aizi, a k Zk) is a (circular symmetric complex) multivariable normal distribution 
with mean zero. That is, there is a matrix M £ <C kxN such that y := Mv, where v £ is a vector 
of independent normal variables of mean and variance 1. 

It is a standard fact of multivariate normal distributions that they are are completely specified 
by the mean vector \i and the covariance matrix £ of the distribution, i.e. the probability density 
function of y is given by 

^p-exp {-y^YT x y + rfy) . (34) 
In our case fi = 0, while the covariance matrix Ejj = E (y*yj) is given by 

£ = | f "l Q | , (35) 

with 

Qij = aiajE (v s(i )(Uv) r (j)) = aiajU 3 (iy(jy (36) 
Thus ||S — I||oo < k 2 maxjj e [7v] \Uij\ < k 2 2~^ c( - u \ which implies 

(1 _ k 2 2^ c ^)l < S < (1 + k 2 2~\ c ^)l (37) 

and 

(1 + kH-^W)- 1 ! < S" 1 < (1 - fc 2 2-3 <7 ^)- 1 I. (38) 

For much smaller than 2 C ^) we thus see that the covariance matrix S is close to the identity, 
which means that the distribution over y is close to the uniform. In the rest of the proof we make 
this observation quantitative. 
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We have 



P = Pr(Re(tfi) > 0,Re(y 2 ) > 0,...,Re(y k ) > 0) 

= \^\- k TT~ k exp (-y^^y) d yi ...dy k 

jRe( yi )>0,...,Re(y k )>0 v J 

< \n~ k 7r- k [ exp (-(1 + fc 2 2-3°W)-yy) d yi ...dy k 

jRe( yi )>0,...,Re(y k )>0 v 7 

^ /i + jfe22-i°w V _ fc /■ / Mj , 

< TT^TTT- T / exp[-y i y)dyi...dy k 



'l + fc2 2 -|C(t/)- 

1-^2-^(1/)) 



2~ fc , (39) 



where the two inequalities in the Eq. ((39|) above follow from the two sides of Eq. (j38]) . Then using 
the bound 

< 1 + 6ka, (40) 



l-a 

valid for all < a < 1, we get 

P< (I + 6k 3 2- c W 2 )2- k . (41) 

By a completely similar argument (using again the two sides of Eq. (|38)> and Eq. (|40)) ) we also 
find 

P > 1 _ fc 2 » 2" fc > (1 - Qk 3 2- c ^ 2 )2- k , (42) 

and we are done. □ 



V. CLASSICAL UPPER BOUNDS 

In this section we prove Theorems IVl and I VII 
Proof (Theorem W\ 

Let (ij)be such that \U itj \ = 2~ C(JJ ^ 2 . Assuming that Re(J7^-) > Im(Ui j) 9 , we get Re(C/ i ,,) > 

2 -C(E/)/2+l_ 

The algorithm for U-ClRCUIT CHECKING in the independent query model works as follows: 
One queries f r (i) and g r {j) over ./V = \Re(Uij)~ 2 log(l/e)] independent realizations of the oracle 
(labelled by r) and computes 

1 N 

E N-=JfJ2frd)9r(j), (43) 
r=l 

deciding that the functions are U-correlated if > Re(f/jj)/4. 



9 Otherwise we consider instead the unitary y 7 — 1U 
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In the case of independent / and g, we have K(f(i)g(j)) = 0. In the remainder of the proof we 
show that for U-correlated / and g, K(f(i)g(j)) > Re(C/jj)/2. Then Chernoff bound gives that the 
algorithm fails with probability at most e. 

Let us turn to the lower bound on K(f(i)g(j)) in the case of U-correlated / and g. We have 

nf(i)9(j)) = E(sgn(^)sgn(Re([/^-)). (44) 

Note that E( Vi Re(Uv)j)) = Re(U itj ) > 2~^ c{u ^l 2+l \ So all we have to do is to check that the 
discretized version given by Eq. (|44)) has a similar expectation value. 

First we write 

E(sgn(u i )sgn(Re(i7u) i )) = Pr(u i Re(i7u) j > 0) - Pr(u i Re(i7u) j < 0) 

= 2 Pr (viRe(Uv)j > 0) - 1 

= 4Pr (vi > and Re(Uv)j > 0) - 1. (45) 

Now define the bivariate normal variable w := (w±,w 2 ) with w\ = vi and w 2 ■= (Uv)j. The 
probability distribution of w is completely characterized by the covariance matrix with entries 

Sfc ; := K(wkWi ), which reads 

Then, 

Pr ( Vi > and Re{Uv)j > 0) 
= |S| _2 7T~ 2 / exp ( -it^E -1 ™) dw\dw 2 

= |£|- 2 vr- 2 / exp (-(1 - \Uij\)- l w ] w + 2Re(w* 1 w 2 U itj )) dwidw 2 

JRe{w 1 )>0,Re{w2)>0 ^ ' ' 

> |£|- 2 7T- 2 / exp (-(1 - Vw) (1 + 2Re(w* 1 w 2 U itj )) d Wl dw 2 

JRe(w 1 )>0,Re{w2)>0 ^ ' 

= 7r~ 2 / exp (-w*w) (1 + 2Re(wlw 2 Uij)(l - \U itj \) 2 ) dw 1 dw 2 

jRe{w 1 )>0,Re(w 2 )>0 ^ ' 

I (, + WMLzIMl) . (47) 



4 

where we used basic facts of Gaussian integrals and that e x > 1 + x, for x > 0. □ 

We now turn to the proof of Theorem [Vi] which is largely based on recent techniques of Van 
den Nest for the efficient classical simulation of certain types of quantum states and operations 
Jl^]. We will make use of the notion of computational tractable states, which are defined below in a 
slightly more general way than in J3^], in order to accommodate for oracle queries. 



Definition V.l 11391/ A state on n qubits \if)) is /-computational tractable given access to the oracle func- 
tion f^p : {0, l} m — > {0, 1} (with m = poly(n)) if the following holds 



(a) it is possible to sample from the probability distribution Pr(x) := |(x|V>)| 2 on the set of n-bit 
strings in poly(n) time in a classical computer with poly(ra) many queries to fy, and 
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(b) upon input of any bit of x, the coefficient (x\ 
computer with poly(n) queries to fy. 

Then we have: 



can be computed in poly(n) time on a classical 



Proposition V.2 139] Let \tp) and \<f>) be f -computational tractable states (given access to oracle f) of n 
qubits each and let A be an efficiently computable sparse n-qubit operation with ||^4||oo < L Then there 
exists an efficient classical algorithm to approximate (cj)\A\ijj) with polynomial accuracy in n, given access 
to the oracle f. 

In Us)] Van den Nest proved Proposition lV.2l in the non-oracular case. However, it is easy to check 
that his proof carries through without any modification to cover the statement of Proposition lV.2l 

Proof (Theorem ED 

Let U be the sparse approximation of U with only poly(n) many non-zero entries in each row 
and column and such that \\U — U\\oo < 0.03. Let |/) and \g) be the states given by Eqs. @ 
and ||5). Note that |/) and \g) are /- and ^-computational tractable, respectively. Indeed any of 
their coefficients can be read directly from the oracles / and g, while the probability distribution 
Pr(x) := |(x|/)| 2 (and analogously |(x|<?)| 2 ) is uniform and therefore easily samplable. 

From Proposition III. II we see it suffices to calculate K^l^l/)! 2 to accuracy < 0.07 in order to 
solve U-ClRCUlT Checking with high probability and, indeed, 

IN£/|/>| 2 -|WI/}| 2 | = \(f\(u\g)(g\tf-U\g)(g\m)\f)\ 

< U\g)(g\Ut-U\g){g\& 



U\g)-U\g) . U\g) + U\g) 



< 2 



U-U 



< 0.06. 



(48) 
□ 



VI. RANDOM CIRCUITS ARE APPROXIMATE 3-DESIGNS 



In this section we prove that random quantum circuits of linear length form an approximate 
unitary 3-design, which is the main technical contribution of the paper. 

We consider two classes of random quantum circuits, both defined as random walks on U(2 n ): 

• uniform random circuit: in each step two indices i ^ j are chosen uniformly at random from 
[n] and a two-qubit unitary gate U-ij drawn from the Haar measure on U(4) is applied to 
qubits i and j. 

• local random circuit: in each step of the walk an index i is chosen uniformly at random from 
[n] and a two-qubit gate t/^j+i drawn from the Haar measure on U(4) is applied to the 
two neighbouring qubits % and % + 1 (we arrange the qubits on a circle, so we identify the 
(n + l)-th qubit with the first). 

Throughout this section we will focus on local random circuits and then show how our results 
can be extended to uniform random circuits. 
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We will make use the folllowing well-known correspondence of superoperators and operators, 
which allow us to evaluate the eigenvalues of the former by computing the eigenvalues of the 
latter. Given a superoperator Q given by 

g{X):=Y J A k XBl (49) 

k 

we define the operator 

G:=^A k ®B k , (50) 
k 

with X the complex conjugate of X. 

Let X be such that tr(XX') = 1 and Q{X) = XX, for a complex number A, i.e. X is an 
eigenoperator of Q with eigenvalue A. Then defining \X) := X <g> I|<3?), with 

|<&>:=$>>®|fc>, ( 51 ) 

it holds that = \\X), i.e. |X) is an eingenvector of G with eingenvalue A. 
A direct implication of this correspondence is that 



2^2 



IIGIloo- (52) 



Proof (Theorem [TTT|) 

Let {fi(dll), U} be the distribution of unitaries after one step of the random walk according to 
the local random circuit model. Following Eq. (|49)) , define 



G„. kt := / n* K (dU)U m ®lT\ (53) 
Ju(d) 

where fi* k is the /c-fold convolution of \i with itself, i.e. 

// fc := J 8 Ul ... Uh fi(dU l )...fi(dU k ). (54) 
In the sequel we show that for t = 2,3, 

HG/i-fc.t - G/ihAoo < ( 1 - — J , (55) 



with is the Haar measure on U(2 n ). Then by Def. 111.41 and Eq. (|52)> we find that 
|^*5n iog(i/e) ^U), JJ} is an e-approximate unitary 3-design, which is the statement of the theorem. 

Following JH], we have G„*k t = (M t ^ n ) k , with 

n 

M t , n :=~Y / Pi,i+i (56) 

and 

Pi,i+i--= [ MdU)U?* +1 ®UZl +l . (57) 

JU(4) 



n . 
i=i 
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Moreover the projector onto the eigenvalue-one subspace of M t is equal to G mt t, since I3p|, 33T] 



lim ||G * fc t - G m .t||oo = 0. (58) 

fc— >oo 



Therefore 

l|G^, i -G to , t || 00 = (A 2 (M t , n )) fc , (59) 

with Xk{X) the fc-th largest eigenvalue of X. 

Lemma [VI . 1 1 and Lemma IVI.4I gives that A 2 (M t , n ) < 1 - Then Eq. d55]) is a consequence of 
this bound and Eq. j59l . □ 

The next proposition is the key part of the argument. It shows that in order to upper bound 
A 2 (-Mt,n) it is enough to obtain a sufficiently strong upper bound on A 2 (Mt j 3). The latter is associ- 
ated to the convergence time of a random walk on only three qubits and, therefore, can be more 
easily analysed. 

Lemma VI.l 

\ (M ^1 3 - 4A 2 (M f|3 ) 

A 2 {M t ,n) < 1 — • (60) 

n 

Proof Define := I — Pi,i+i and 

n 

H:=^2 H iA+i = "(I " M *,r0- (61) 

The operator if is a quantum local Hamiltonian (i.e. a sum of terms which act non-trivially 
only on neighbouring sites), composed of local projectors if^i+i, with the following properties: 

• periodic boundary conditions: the (i + l)-th site is identified with the first. 

• zero gound-state energy: A ™ in (H) = 0, with X m [ n (H) the minimum eigenvalue of H. 

• frustation-freeness: every state \ip) in the grounstate manifold, composed of all eigenvectors 
with eigenvalue zero, is such that ifj^+il^} = 0, for all i. 

Let ApT) be the spectral gap of X, i.e. the difference of the second lowest to the lowest eigen- 
values. Then from Lemma fVI.21 we get 



A 2 (M t)n ) = 1 
< 1 
= 1 



A(g) 
n 

2A (H±2 + g 2|3 ) ~ 1 
n 

4 A (I - M t:3 ) - 1 
n 



3-4A 2 (M t3 ) , v 

1 V yi> . (62) 

n 

□ 



The next lemma appeared e.g. in [35fl. 
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Lemma VI.2 1133/ Let H = YliLi f t,t+i ^ e a \oca\ Hamiltonian with periodic boundary conditions, with 
Hi t i + x projectors and \ m \ n (H) = 0. Then the spectral gap of H satisfies 

A(H)>2 min A (H i>i+1 + H i+W ) - 1 (63) 

i£l,...,iV 

Proof Let 7:=2 minjgi,...^ A (i^+i + ^+1^+2) — 1- Then by Lemma IVl.31 

{Hi,i+i + > — (Hi : i+i + Hi + i^ + 2) . (64) 

Rearranging terms in the equation above we get 

1 1 7 

2^vi+l + Hi,i+lHi+l,i+2 + H-i+l,i+2Hi,i+l + 2^+l,i+2 > ^ + ^i+l,i+2) • (65) 

We have 

2 N (1 1 

-f^ 2 > ( ~Hi,i+l + Hi,i+lHi+l,i+2 + Hi+l,i+2Hi,i+l + -^+l,i+2 

i=l ^ 

JV 

> 7 ( + ^H i+W ) = 7 if , (66) 



/I 1 \ 



where the first inequality follows from 

A? 



/I 

i=l ^ 



Hi+l,i+2Hi,i+l + 2^i+l,j+2 



+ H Kk+1 ®H L i +l , (67) 

|fc-«|>l 

and the positivity of flj^+i, and the second one from Eq. (|66|) . Then, by Lemma (|VI.3|) , A(H) > 7. 

□ 

Lemma VI.3 For a positive semi-definite matrix M with Ai(M) = 0, 

A 2 (M) = max 7 : M 2 > 7M (68) 

Proof Let (0, A2, A3, ...) be the vector of ordered eigenvalues of M. Then (0, A 2 ,, A3, ...) are the 
ordered eigenvalues of M 2 and M 2 > 7M holds true if, and only if, A 2 , > jXk for all k, which is 
equivalent to A2 > 7. □ 

The second result we need in the proof of Theorem [III] is the following upper bound on 
A 2 (M t3 ) / valid for t = 2,3: 



Lemma VI.4 For t e {2, 3}, 



A 2 (Af t , 3 ) = ^. (69) 
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Proof 

The operator Mt,3 has the following form 

M t ,3 = i(Pi2 ® I 3 + Ii ® P23) (70) 
In analogy to the definition of Pj^+i, we define the projectors p as follows 



P:= / finidUWf^uf. (71) 

U(2) 



We also consider the associate superoperator 

Vi{X) := [ {iHidUp^Xiu})®*. (72) 
J 11(2) 

From Schur duality we find that all operators X invariant under P, can be written as a sum of 
permutation operators. In more detail, consider the representation of the symmetric group St 
acting on %f i given by 

V V)i \ki) ® - ® |A%> = IVi(l)) ® - ® I^tt-H*))' ( 73 ) 
for every 7r G 5j and G Then it follows that any X satisfying Vi(X) = X is such that 

X = ^c 7r F 7M , (74) 

7T 

for complex numbers c^. Moreover, the subspace defined by p is spanned by the (overcomplete) 
basis given by the non-normalized vectors := Kr,i ® 

Likewise we define 

V l , l+ i(X) := / M^WCl) W - < 75 > 
JU(4) 

and again we find that any X invariant under Pj^+i can be written as a sum of permutartion 
operators Vw^j+n, now permuting the i copies of the Hilbert space Tif- +1 - 

Since = ® it follows that P^i+x C P ® Pj+i and thus 

Pi 2 (8 1 3 + ii ® p 23 = (P12 ® p 3 + Pi ® P23) e (P12 ® P3-) e (Pi 1 ® p 23 ) (76) 

Since the last two terms in the direct sum above have eigenvalues and 1, it follows that 

A 2 (M tj3 ) = X 2 (X)/2, with X given by 

X = P 12 ®P 3 + Pi®P 2 3. (77) 

Note that the support of X is contained in Pi ® P2 ® P3. 

Now, for any Hilbert space %, in a subspace spanned by swaps acting on H®* one can construct 
a basis of operators which is orthonormal in Hilbert-Schmidt scalar product: 
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where the coefficients do not depend on the dimension of H, but only on t (we do not write 
this dependence explicitly). Note that depending on the dimension of %, some Rk may vanish. 
Using the operators R% we can write: 



Pi 



t,i+l 



(t,t+i) 

k 



4" i 



To diagonalize the operator X we need to represent P\$ an d i-2,3 in terms of product basis R k 
R^ and Pjj. <g) P^. , respectively. To this end we use <|78) , which in our case read 



(79) 

(!) <> 



P 



(1.2) 



P 



(1) 



P 



(2) 



7T.2 



A simple calculation gives 



(80) 
(81) 

(82) 



(k) 

where the coefficients r^u form a matrix given by 

r (*) = ( B -i)T A (*) r i 

with B defined as the matrix with entries b^i and the diagonal matrices 

ij ^ki ■ 



(83) 



(84) 



In this way, from the matrix B we can obtain the matrix elements of the projectors Pi 2 and P2,3 
(1) (2) (2) (3) 

in the product bases R k (g> Rj and R k ®R\ , respectively. These, in turn, allow us to obtain the 
matrix elements of X and to compute its eigenvalues. In the following we perform the analysis 
for t = 2 and t = 3. 

2-design. For t = 2, the basis is given by (suitably normalized) projectors onto the symmetric 
and the antisymmetric subspace. The matrix B is then given by 



B 



1 1 

1 _ 1 

2 2 J 



(85) 



where the basis of swaps was ordered as {(), (12)} 10 , while the matrices are given by 





"0 








" 




a 




r (l) - 1 





1 


1 





r (2) _ I 








2 





1 


1 





2 



















_ 




_ 





(86) 



Here () labels the trivial permutation and (12) the swap of systems 1 and 2. 
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with a = |, /3 = |. Diagonalizing X, we obtain that it has the second largest eigenvalue 7/5 11 , 
which gives A 2 (M 3)t ) = 7/10 for t = 2. 



3-design. Here we exploit the orthonormal basis constructed in [5J]: 

R+ = ^(1 + V(i2) + V (13) + F (23) + V {123) + V (132) ), 



Ri 

R2 

R 3 



12 
1 



T^(I - ^(12) - V( 13 ) - V( 23 ) + V(i23) + V( 13 2)), 



12 
1 



(!-#+-#_), 
(2V(23) - V(13) ~ ^(12) )i 



(V(i2) - V(i3)' 



2^/3 
i 

2^/3 



123) 



Vi 



(132), 



(87) 



where permutations are written by means of cycles. The related matrix B is given by 



B 





■ 2 

3 











1 

3 


1 _ 

3 







l 

3 


2 
3 


1 

3 








1 





1 

^3 





1 

V3 








2 














i 

V3 


i 

V3 




1 

6 


1 

6 


1 

6 


1 
6 


1 

6 


1 
6 




1 


1 


1 


1 


1 


1 




L 6 


6 


6 


6 


6 


6 -1 



(88) 



where the basis of swaps is ordered as follows {(), (12), (23), (13), (123), (132)}. Since we work 
with qubits, i? 3 = and hence we have 5 basis elements and X is a 125 x 125 matrix. We have 
computed its matrix elements and then its eigenvalues 11 , and found that again the second largest 
eigenvalue is equal to 7/5. □ 

Lastly let us discuss the case of uniform random circuits. We have: 
Proposition VI.5 5n 2 log (1/e) -sized uniform random circuits form an e-approximate unitary 3-design. 
Proof Following the proof of Theorem [TTT1 is suffices to show that for t = 3, 

A 2 (JVt,n) < 1 " A (89) 
5n z 

with 



n- 



i<j 



and 



Pi 



^U(4) 



(91) 



We have diagonalized the matrix X using the symbolic manipulation program Mathematica. 
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Defining 

H:=Y,Hi, 3 =n 2 (l-N t , n ) (92) 



with Hi j = I - P itj , we find Eq. (89) to be equivalent to A(H) > 1/5. 

Both H and H (given by Eq. (HU) have the same groundspace S$. Furtermore, H > H. Then 

A(H) > min (VI^IV) > , min = A(#) > ± (93) 

where the last inequality follows from Lemmas I VI. 1 1 and I VI.41 □ 



VII. ACKNOWLEDGMENTS 



FB is supported by a "Conhecimento Novo" fellowship from the Brazilian agency Fundacao 
de Amparo a Pesquisa do Estado de Minas Gerais (FAPEMIG). MH is supported by EU grant 
QESSENCE and by Polish Ministry of Science and Higher Education grant N N202 231937. FB 
would like to thank the hospitality of the National Quantum Information Center of Gdansk where 
part of this work was done. FB and MH thank the Intitute Mittag Leffler for their hospitality 
where (another) part of this work was done. 



[1] S. Aaronson. BQP and the Polynomial Hierarchy. FOCS 2010. arXiv:0910.4698vl. 

[2] PW. Shor. Polynomial-time algorithm for prime factorization and discrete logarithms on a quantum 
computer. SIAM J. Comp. 26, 1484 (1997). 

[3] RP. Feynman. Quantum mechanical computers. Inter. J. Theo. Phys. 21, 467 (1982). 

[4] S. Hallgren. Polynomial time quantum algorithms for Pell's equation and the principal ideal problem. 
Proc. of the 34th Symp. on the Theory of Computing, 653 (2002). 

[5] M.H. Freedman, A. Kitaev, and Z. Wang. Simulation of topological field theories by quantum com- 
puters. Comm. Math. Phys. 227, 587 (2002). 

[6] D. Aharonov, V. lones, and S. Landau. A polynomial quantum algorithm for approximating the lones 
polynomial. Proc. 38th Annual ACM Symp. on Theory of computing, 427 (2006). 

[7] A.W Harrow, A. Hassidim, S. Lloyd. Quantum algorithm for solving linear systems of equations. 
Phys. Rev. Lett. 103, 150502 (2009). 

[8] E. Bernstein and U. Vazirani. Quantum complexity theory. SIAM J. Comp. 26, 1411 (1997). 

[9] D.R. Simon. On the power of quantum computation. Siam J. Comp. 26, 1474 (1997). 
[10] A. Kitaev. Quantum measurements and the abelian stabilizer problem, quant-ph/9511026. 
[11] M. Mosca and A. Ekert. The hidden subgroup problem and eigenvalue estimation on a quantum 
computer. Proc. of the 1st NASA Internat. Conf. on Quant. Comput. and Quant. Comm., vol 1509 of 
Lecture Notes in Computer Science (1999). 
[12] J.N de Beaudrap, R. Cleve, and J. Watrous. Sharp quantum vs. classical query complexities separa- 
tions. Algorithmica 34, 449 (2002). 
[13] W. van Dam and Hallgren. Efficient quantum algorithms for shifted quadratic character problems. 
quant-ph/0011067. 

[14] J. Watrous. Quantum algorithms for solvable groups. Proc. 33rd ACM Symp. on the Theory of Com- 
putation, 60 (2001). 

[15] A.M. Childs, R. Cleve, E. Deotto, E. Farhi, S. Gutmann, and D.A. Spielman. Exponential algorithmic 
speedup by quantum walk. Proc. 35th ACM Symposium on Theory of Computing (STOC 2003), pp. 
59-68. 



23 



[16] N. Linial and N. Nisan. Approximate inclusion-exclusion. Combinatorica 10, 349 (1990). 
[17] M. Braverman. Poly-logarithmic independence fools AC circuits. Proc. IEEE Conf. on Comput. Com- 
plex., pages 3-8, 2009. 

[18] S. Aaronson. A Counterexample to the Generalized Linial-Nisan Conjecture. ECCC TR10-109. 
[19] Y. Han, L. Hemaspaandra, and T. Thierauf. Threshold computation and cryptographic security. Siam 
J. Comput. 26, 59 (1997). 

[20] R. Beals, H. Buhrman, R. Cleve, M. Mosca and R. de Wolf. Quantum Lower Bounds by Polynomials. 
J. ACM 48, 778 (2001). 

[21] S. Aaronson and A. Ambainis. The Need for Structure in Quantum Speedups. arXiv:0911.0996. 

[22] D. Deutsch. Quantum Theory, the Church-Turing principle and the universal quantum computer. 

Proc. of the Royal Society A 400, 97 (1985). 
[23] D. Deutsch and R. Jozsa. Rapid solutions of problems by quantum computation. Proc. of the Royal 

Society A 439, 553 (1992). 

[24] S. Hallgren and A.W. Harrow. Superpolynomial speedups based on almost any quantum circuit. In 

Proc. of the 35th International Colloquium on Automata, Languages and Programming (ICALP 2008), LNCS 

5125, pp. 782-795. arXiv:0805.0007 
[25] C. Dankert, R. Cleve, J. Emerson, and E. Livine. Exact and approximate unitary 2-designs and their 

application to fidelity estimation. Phys. Rev. A 80, 012304 (2009). 
[26] D. Gross, K. Audenaert, and J. Eisert. Evenly distributed unitaries: on the structure of unitary designs. 

J. Math. Phys. 48, 052104 (2007). 
[27] J. Emerson, E. Livine, and S. Lloyd. Convergence Conditions for Random Quantum Circuits. Phys. 

Rev. A 72, 060302 (2005). 

[28] R. Oliveira, O.C.O. Dahlsten, and M.B. Plenio. Efficient Generation of Generic Entanglement. Phys. 
Rev. Lett. 98, 130502 (2007). 

[29] O.C.O. Dahlsten, R. Oliveira, and M.B. Plenio. Emergence of typical entanglement in two-party ran- 
dom processes. J. Phys. A: Math. Theor. 40, 8081 (2007) 

[30] A.W. Harrow and R.A. Low. Random Quantum Circuits are Approximate 2-designs. Commun. Math. 
Phys. 291, 275 (2009). 

[31] I.T. Diniz and D. Jonathan. Comment on the paper "Random Quantum Circuits are Approximate 

2-designs". arXiv:1006.4202 
[32] L. Arnaud and D. Braun. Efficiency of producing random unitary matrices with quantum circuits. 

Phys. Rev. A 78, 062329 (2008). 
[33] W.G. Brown and L. Viola. Convergence Rates for Arbitrary Statistical Moments of Random Quantum 

Circuits. Phys. Rev. Lett. 104, 250501 (2010). 
[34] P. Hayden and J. Preskill. Black holes as mirrors: quantum information in random subsystems. Journal 

of High Energy Physics 0709, 120 (2007) 
[35] R. Alicki, M. Fannes and M. Horodecki. On thermalization in Kitaev's 2D model. J. Phys. A: Math. 

Theor. 42, 065303 (2009) 

[36] M. Fannes, B. Nachtergaele, and R. F. Werner. Finitely correlated states on quantum spin chains. 
Comm. Math. Phys. 144, 443 (1992). 

[37] B. Nachtergaele. The spectral gap for some spin chains with discrete symmetry breaking. Commun. 
Math. Phys. 175, 565 (1996). 

[38] D. Perez-Garcia, F. Verstraete, M.M. Wolf, and J.I. Cirac. Matrix Product State Representations. Quan- 
tum Inf. Comput. 7, 401 (2007). 

[39] M. Van den Nest. Simulating quantum computers with probabilistic methods. arXiv:0911.1624. 

[40] A. Roy and A.J. Scott. Unitary designs and codes. Designs, codes and cryptography 53 (2009). 

[41] A.W. Harrow and R.A. Low. Efficient Quantum Tensor Product Expanders and k-designs. Proceedings 
of RANDOM 2009, LNCS, 5687:548-561, 2009 

[42] R. Low. Large deviation bounds for k-designs. Proc. R. Soc. A 465, 3289 (2009). 

[43] A. Ben-Aroya, O. Schwartz, and A. Ta-Shma. Quantum Expanders: Motivation and Construction. 

Theory of Computing 6, 47 (2010). 
[44] M.B. Hastings. Random Unitaries Give Quantum Expanders. Phys. Rev. A 76, 032315 (2007). 
[45] A. Ben-Aroya, O. Schwartz, and A. Ta-Shma. An Explicit Construction of Quantum Expanders. 

arXiv:0709.0911. 

[46] D. Gross and J. Eisert. Quantum Margulis expanders. Quant. Inf. Comp. 8, 722 (2008). 



24 



[47] A.W. Harrow. Quantum expanders from any classical Cayley graph expander. Quant. Inf. Comp. 8, 
715 (2008). 

[48] M.B. Hastings and A.W. Harrow. Classical and Quantum Tensor Product Expanders. Quant. Inf. 
Comp. 9, 336 (2009). 

[49] B. Fefferman and C. Umans. Pseudorandom generators and the BQP vs. PH problem. arXiv:1007.0305. 

[50] B. Barak, R. Shaltiel and A. Wigderson. Computational analogues of entropy. Lecture Notes in Com- 
puter Science 2764, pages 200215. Springer, 2003. 

[51] N. Nisan and A. Wigderson. Hardness vs randomness. J. Comput. Syst. Sci., 49(2):149167, 1994. 

[52] R. Low. Pseudo-randomness and Learning in Quantum Computation. PhD Thesis, University of Bris- 
tol, UK, 2010; arXiv:1006.5227. 

[53] Martin Burrow. Representation Theory of Finite Groups. Dover Publications, April 1993. 

[54] T. Eggeling and R. F. Werner. Separability properties of tripartite states with U U (^) U symmetry. 
Phys. Rev. A 63, 042111, 2001. 



